The Hot Drop

Oct 13

The Hot Drop for 10-13-2026

FBI locks down ShinyHunters’ third suspect after breaching the FBI jobs portal. Meanwhile, GitLab’s 10.0 critical flaw lets attackers run code without a single login. And what if your supermarket defrosting button is now a remote kill switch?

Since the last show: 4 new · 1 developing · 9 dropped · 7% overlap with the previous show

Contents

  1. FBI Arrests Third ShinyHunters Suspect in Pennsylvania
  2. GitLab Patches Critical Unauthenticated RCE in CI/CD Regex Compiler
  3. Cyberattack triggers defrosting at 350 French supermarkets via Danfoss vulnerabilities
  4. CyberXero Orchestrates 51 AI Agents; SOAR Pipeline Cuts Cobalt Strike Dwell Time
  5. AhsayCBS Exploitation: Webshells and Miners Deployed via Unpatched Flaws

1. FBI Arrests Third ShinyHunters Suspect in Pennsylvania (Lead)

Event now covered by 13 outlets (was 12); Blast radius expanded: new vendor(s): instructure, anthropic, cisco, aws govcloud; new product(s): telegram, snowflake, rockstar games, canvas; 2 new indicator(s) observed

What changed

The FBI arrested Edward Dubrovsky in Pennsylvania, marking the third major takedown in the ShinyHunters extortion case. Dubrovsky, a Canadian cybersecurity executive and former ransomware negotiator, is now held at a federal detention center in Philadelphia. This arrest follows the earlier detentions of Saif al-Din Khader in Jordan and Pepijn van der Stap in the Netherlands. Keep an eye on any unusual traffic to fbijobs[.]gov or related government HR portals.

How it works

ShinyHunters breached FBI systems using an alleged Oracle PeopleSoft zero-day vulnerability before spreading laterally into FBI-managed AWS GovCloud systems. ShinyHunters claimed it had stolen information on nearly every FBI employee, with the breach affecting the agency’s jobs site.

Limits and watch

Monitor for new disclosures from the cooperating detainee Saif al-Din Khader, who is providing information to the FBI to identify other ShinyHunters members. Watch for further arrests or legal actions in the Eastern District of Texas, where the investigation into ShinyHunters’ $70 million extortion campaign is centralized.

Techniques

  • T1003.003 NTDS (Credential Access)
  • T1005 Data from Local System (Collection)
  • T1006 Direct Volume Access (Stealth)
  • T1016 System Network Configuration Discovery (Discovery)
  • T1018 Remote System Discovery (Discovery)
  • T1021.001 Remote Desktop Protocol (Lateral Movement)
  • T1021.004 SSH (Lateral Movement)
  • T1021.007 Cloud Services (Lateral Movement)
  • T1027.003 Steganography (Stealth)
  • T1036.005 Match Legitimate Resource Name or Location (Stealth)
  • and 10 more

Named actors and malware

  • ShinyHunters (actor)
  • Cl0p (malware)
  • Scattered Spider (actor)
  • Clop (malware)
  • TeamPCP (actor)
  • ShinyHunters group (actor)

Indicators

  • 18 indicators on file

Coverage

2. GitLab Patches Critical Unauthenticated RCE in CI/CD Regex Compiler (Segment)

Event first seen in a show

GitLab released urgent patches on October 12, 2026, to fix CVE-2026-97229, a critical vulnerability with a CVSS score of 10.0 that allows unauthenticated attackers to execute arbitrary code on servers. Rapid7 Intelligence independently reproduced the exploit on an unpatched official image, confirming the risk is real, although no confirmed active exploitation of this specific bug has been reported yet. If you run self-managed GitLab, patch immediately.

Today, GitLab CE and EE versions 19.2 through 19.4 allowed unauthenticated code execution via a crafted regex in CI/CD configs due to insufficient validation. This flaw stems from an integer overflow in resource calculations, enabling arbitrary code execution with a CVSS score of 10. This weakness affects GitLab versions 19.2 through 19.4, allowing an attacker to crash the server or execute arbitrary code without authentication. Versions 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 face a CVSS 10 crash risk from integer overflow logic. The flaw stems from integer overflow in a calculation that assumes values grow larger, allowing attackers to force wraparound. Today GitLab patched CVE-2026-97229, where an unauthenticated user exploited a flawed regex in CI/CD configs to trigger integer overflow and execute arbitrary code. This weakness affects GitLab versions 19.2 through 19.4, potentially causing denial of service or memory exhaustion when the overflow wraps to negative values.

Defenders must patch all affected versions immediately, as no confirmed exploitation exists yet and static analysis detects the overflow. Defenders must update affected systems immediately and run automated static analysis to detect the integer overflow pattern in their current configurations. The absence of confirmed in-the-wild exploitation of this specific bug does not reduce the urgency, as the vulnerability was reported through GitLab’s HackerOne program and allows attackers to bypass authentication entirely. Apply the urgent patches released on October 12, 2026, to upgrade self-managed GitLab instances to versions 19.2.8, 19.3.4, or 19.4.2 to close the unauthenticated code execution vector. Verify that CI/CD configurations do not contain untrusted regular expressions, as Rapid7 Intelligence confirmed that arbitrary code execution is reproducible on unpatched official images via this specific input vector.

While Rapid7 reproduced the exploit on an unpatched image, the specific conditions required to trigger the integer overflow in the CI/CD compiler remain a technical detail that may limit the attack surface for some configurations. Monitor for signs of supply-chain tampering in CI/CD dependencies, such as unexpected package manager downloads or lifecycle hook executions, which align with the T1677 technique for compromising development tools. Watch for direct modifications to CI configuration files like gitlab-ci[.]yml, as T1195.001 indicates that adversaries may inject malicious code into build processes to exfiltrate credentials or deploy further payloads.

Vulnerabilities

  • CVE-2026-97229 — CVSS 10 (Critical) · CWE-190 · GitLab GitLab. GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to…

Techniques

  • T1195.001 Compromise Software Dependencies and Development Tools (Initial Access)
  • T1677 Poisoned Pipeline Execution (Execution)

Indicators

  • 1 indicator on file

Coverage

3. Cyberattack triggers defrosting at 350 French supermarkets via Danfoss vulnerabilities (Segment)

Event first seen in a show

What changed

Threat actors hijacked refrigeration controllers at major French supermarkets, forcing automatic defrosting cycles and spoiling food across 250 to 350 stores. The incident hit Intermarché, Carrefour Market, Leclerc, and other chains on Sunday night. While Danfoss released patches in March 2025, the targeted devices were running older software. Check your asset inventory for Danfoss AK-SM 8xxA Series devices running versions prior to 4.3.1. Threat actors exploited known flaws in Danfoss AK-SM 8xxA Series controllers, specifically CVE-2025-41450 and CVE-2025-41451. Predicta Lab identified 2,752 exposed Danfoss systems online, with 1,590 in France. The Paris prosecutor’s office has opened a formal investigation. Ahold Delhaize took systems offline as a precaution, though no direct link to this specific attack is confirmed.

How it works

Threat actors exploited CVE-2025-41450 to bypass authentication on Danfoss AK-SM 8xxA Series controllers prior to version 4.2. They then leveraged CVE-2025-41451 to inject OS commands into the alarm-to-mail configuration fields, achieving remote code execution on the system. The OS shell mishandles alarm-to-mail fields, letting attackers inject semicolons to execute unauthorized commands via static analysis detection. The flaw stems from improper neutralization of alarm-to-mail fields, allowing attackers to inject commands into downstream processing layers. Danfoss AK-SM8xxA Series before version 4.3.1 today allows post-authenticated remote code execution via Command Injection in alarm-to-mail config fields. The flaw exploits a separate weakness where the implemented mechanism can be bypassed despite a sound underlying algorithm, enabling unauthorized access without network interaction. Danfoss AK-SM 8xxA Series units before version 4.2 face a high-severity authentication bypass via CWE-305, letting remote attackers skip primary checks. The same series before version 4.3.1 carries a medium-severity denial of service risk from improper handling of external configuration exceptions. A CVSS 8.7 weakness allows attackers to execute unauthorized commands by failing to neutralize special elements within the OS shell. Another CVSS 8.7 flaw grants post-authenticated execution, enabling unauthorized code runs on the attacked system. The attack affected 250 to 350 stores, causing significant financial losses and food waste. Claroty’s Team82 research team published a detailed write-up in August demonstrating how the flaws enable remote code execution on publicly accessible Danfoss AK-SM 800A management interfaces. Unlike other event members, this specific weakness targets the web interface configuration setting, allowing remote denial of service without requiring code execution or registry manipulation.

What to do

Defenders must validate all user input before constructing shell commands to prevent unauthorized remote code execution. Defenders must verify their AK-SM 8xxA Series units are at version 4.2 or later to close this remote authentication bypass before the next patch cycle. Defenders must apply version 4.3.1 immediately to stop the high-integrity compromise described in the 8.7 CVSS score. Defenders must verify Danfoss firmware is at version 4.3.1 or later to prevent this Command Injection exploit. Defenders must patch the Danfoss firmware immediately to prevent integrity compromise, as static analysis can identify the improper neutralization pattern. Defenders must verify version 4.3.1 installation and apply static analysis to neutralize special elements in command strings. Defenders must verify firmware version 4.3.1 or higher is installed on all affected AK-SM8xxA units immediately. Install software version 4.3.1 on all Danfoss AK-SM 8xxA Series devices to remediate the command injection and denial-of-service vulnerabilities disclosed in advisory DSA-2025-08-01. Apply the latest patch with number 4.2 to address the authentication bypass flaw that exposes internal IP addresses and usernames on devices prior to that version.

Limits and watch

While static analysis detects this pattern, confirm the specific patched version in the official release notes before deploying updates. Until version 4.3.1 is deployed, operators cannot assume the system resists post-authenticated remote code execution attempts. Until the patch arrives, watch for repeated control character detections in the alarm-to-mail configuration stream as a signal of exploitation attempts. Monitor for repeated detection of control characters by filters, which serves as a specific indicator for the exploitation of multiple input interpretation layers in command injection attempts. Prioritize automated static analysis to identify data flow patterns connecting input sources to command sinks, as this method can detect command injection weaknesses without executing the code.

Vulnerabilities

  • CVE-2025-41451 — CVSS 8.7 (High) · CWE-77 · Danfoss AK-SM8xxA Series. Improper neutralization of alarm-to-mail configuration fields used in an OS shell Command (‘Command Injection’) in Danfoss AK-SM8xxA Series prior to version 4.3.1, leading to a potential post-authenticated remote code…
  • CVE-2025-41450 — CVSS 8.2 (High) · CWE-305 · Danfoss AK-SM 8xxA Series. Improper Authentication vulnerability in Danfoss AKSM8xxA Series.This issue affects Danfoss AK-SM 8xxA Series prior to version 4.2
  • CVE-2025-41452 — CVSS 6.8 (Medium) · CWE-15 · Danfoss AK-SM8xxA Series. Post-authenticated external control of system web interface configuration setting vulnerability in Danfoss AK-SM8xxA Series prior to 4.3.1, which could allow for a denial of service attack induced by improper handling…

Indicators

  • 6 indicators on file

Coverage

  • [DSA-2025-03-01 Danfoss](https://danfoss.com/en/service-and-support/coordinated-vulnerability-disclosure/danfoss-security-advisories/dsa-2025-03-01)
  • [DSA-2025-08-01 Danfoss](https://danfoss.com/en/service-and-support/coordinated-vulnerability-disclosure/danfoss-security-advisories/dsa-2025-08-01)
  • Cyberattack shuts down refrigerators at French supermarkets

4. CyberXero Orchestrates 51 AI Agents; SOAR Pipeline Cuts Cobalt Strike Dwell Time (Segment)

Event first seen in a show

SOCRadar researchers linked a Russian-speaking initial access broker, dubbed CyberXero, to a campaign that stole 628,000 records from Ukrainian energy infrastructure. In a single automated run, the pipeline scanned 4,708 targets, compromising 429 WordPress admin panels and deploying 32 webshells in just 61 seconds. While the attack vector is clear, specific details like the installation of Gh0st RAT alongside Cobalt Strike come from single-source reports, so treat those specifics with caution. Security engineer Ravishka Rathnayaka released a Python-based SOAR pipeline on GitHub that ingests SIEM alerts from Splunk and Elastic. By querying AbuseIPDB and VirusTotal in parallel, the system distinguishes high-risk Cobalt Strike traffic from benign administrative noise, reducing incident response dwell time from fifteen to forty-five minutes down to sub-second latency. Watch for the specific Cobalt Strike C2 infrastructure identified in the dossier, particularly the IP 118[.]25[.]6[.]39, which scored a perfect one hundred on reputation checks. Check your lead sheet for the full IOC list and the GitHub repository link.

The global pipeline uses a custom tool called wp2shell, which abuses a flaw in the WordPress REST API to inject SQL, plant a rogue admin account, and drop a webshell. The actor ran up to 51 specialized Claude Code agents on the primary workstation, assigned to roles like exploit chaining, lateral movement, and reconnaissance. SOCRadar researchers identified the actor as an initial access broker who exploited a misconfigured server to expose over 90,000 files containing session logs and stolen victim data. Threat actors used the Cobalt Strike tool to target internal systems with APT and ransomware, utilizing web services to relay data and hide command-and-control traffic in expected network noise.

On Tuesday the wp2shell tool abused the WordPress REST API to plant webshells in Apache httpd[.]exe processes, creating a direct bridge from the compromised admin panel to the internal network. This technical condition enables the attacker to bypass perimeter defenses by using a legitimate web service for data relay, which provides cover for the Cobalt Strike C2 traffic targeting IP 118[.]25[.]6[.]39. The exposure changes because the defender must now prioritize blocking the specific outbound traffic to that high-reputation IP while restricting web-based content access to prevent further exploitation of the installed webshells. The attacker behavior of deploying 51 specialized AI agents to chain exploits and install Coinminer malware creates a high-uncertainty scenario regarding the true scope of the compromise. While the global pipeline confirmed access to 429 WordPress panels, the specific role of these AI agents in the Ukrainian energy infrastructure campaign remains attributed to single-source reports. The most useful investigation focus is verifying the presence of the XMRig Coinminer and checking for outbound block rules generated by the SOAR pipeline to confirm if the 15 to 45 minute dwell time has been reduced to sub-second latency. CyberXero operates as a Russian-speaking initial access broker who sells compromised network access to other criminals, including APT groups and ransomware operators. The actor’s pipeline abuses the WordPress REST API to inject SQL and plant rogue admin accounts, establishing a foothold that facilitates the deployment of Cobalt Strike and Monero coinminers. Implement network intrusion prevention signatures and restrict web-based content via URL filtering to block traffic to unauthorized external web services used for command and control.

While SOCRadar links CyberXero to both WordPress and Ukrainian energy campaigns, the specific infrastructure overlap between these two distinct operational theaters is not fully detailed in the current evidence. Watch for unusual outbound SSL/TLS connections from non-browser processes to Discord or Slack, a sign that Cobalt Strike is using legitimate platforms for command and control. Track behavioral chains where uncommon processes start external network connections followed immediately by file creation, indicating ingress tools moving via web services.

Techniques

  • T1102 Web Service (Command And Control)
  • T1105 Ingress Tool Transfer (Command And Control)
  • T1110 Brute Force (Credential Access)
  • T1496.001 Compute Hijacking (Impact)
  • T1505.003 Web Shell (Persistence)
  • T1583.006 Web Services (Resource Development)
  • T1584.006 Web Services (Resource Development)
  • T1684 Social Engineering (Stealth)
  • T1686.003 Windows Host Firewall (Defense Impairment)

Named actors and malware

  • Cobalt Strike (malware)
  • Gh0st RAT (malware)

Indicators

  • 22 indicators on file

Coverage

5. AhsayCBS Exploitation: Webshells and Miners Deployed via Unpatched Flaws (Hot)

Event first seen in a show

Huntress confirmed threat actors are actively exploiting two unpatched flaws in AhsayCBS backup servers, specifically CVE-2026-105133 and CVE-2026-105134, to compromise at least five organizations. The attack chain began on October 7, linking an authentication bypass to unauthenticated remote code execution. Although the National Vulnerability Database listed version 10.3.4 as a fix, Huntress verified that the latest release remains vulnerable to this chained attack. The campaign originated from Hong Kong, Vietnam, and Taiwan, with payloads downloaded from Alibaba Cloud endpoints. Since Ahsay has not responded to patch inquiries, immediate mitigation is required. Restrict access to the AhsayCBS management interface to trusted IPs or force VPN connections now. Attackers are dropping JSP webshells and XMRig miners disguised as Microsoft Edge components. The confirmed chain downloads Taskgmr.ps1, edge[.]exe, msedge[.]exe, and config[.]json into temporary folders from an Alibaba Cloud Object Storage endpoint. Analysts identified edge[.]exe as an XMRig miner and msedge[.]exe as a modified NSSM utility used for process persistence. These processes connect to mining pools at xmr[.]kryptex[.]network and IP 51[.]195[.]127[.]124.

AhsayCBS 10.3.2 allows attackers to run NT AUTHORITY/SYSTEM commands by manipulating the random argument in the UpdateReceivers[.]do endpoint. The attack starts by exploiting CVE-2026-105133, an improper authentication flaw in the checkSysPwd function, to bypass access controls on the AhsayCBS API. Attackers then leverage CVE-2026-105134, an OS command injection in the UpdateReceivers[.]do endpoint, to achieve unauthenticated remote code execution as NT AUTHORITY/SYSTEM. AhsayCBS versions through 10.3.2 allow unauthenticated remote code execution as SYSTEM via the UpdateReceivers[.]do endpoint. This flaw scores 9.3 on CVSS 4.0, granting unauthenticated remote code execution that can crash the host or exfiltrate data. The campaign targets backup management systems used by Managed Service Providers, with confirmed compromises affecting at least five distinct organizations.

This access vector enables the deployment of XMRig miners and webshells, directly impacting the availability and integrity of backup infrastructure used by MSPs. Upgrade to version 10.3.4 immediately to stop attackers from injecting OS commands through the random parameter and close the CWE-287 gap. Hunt for files named edge[.]exe and msedge[.]exe in temporary folders that are communicating with the identified Alibaba Cloud endpoints or mining pools.

Static analysis flags the flaw, but false positives require manual verification of the /rps/api/json/UpdateReceivers[.]do code. No public exploit exists yet, making immediate patching the only confirmed mitigation. Although the exploit is published, no specific attack pattern targets this Replication Receiver component yet. Confirming the fix requires verifying the specific version upgrade on the affected host. Huntress researchers confirmed the latest release remains vulnerable, contesting the effectiveness of the reported version 10.3.4 patch. Ahsay has not responded to patch inquiries, leaving the definitive remediation timeline unknown. Watch for sustained high CPU usage from masqueraded binaries like edge[.]exe or msedge[.]exe, which signals active compute hijacking for cryptocurrency mining.

Vulnerabilities

  • CVE-2026-105134 — CVSS 10 (Critical) · CWE-78, CWE-77 · Ahsay AhsayCBS. A flaw has been found in Ahsay AhsayCBS up to 10.3.2.
  • CVE-2026-105133 — CVSS 6.9 (Medium) · CWE-287 · Ahsay AhsayCBS. A vulnerability was detected in Ahsay AhsayCBS up to 10.3.2.

Techniques

  • AML.T0049 Exploit Public-Facing Application (Initial Access)
  • AML.T0050 Command and Scripting Interpreter (Execution)
  • AML.T0079 Stage Capabilities (Resource Development)
  • AML.T0089 Process Discovery (Discovery)
  • T1021 Remote Services (Lateral Movement)
  • T1036.004 Masquerade Task or Service (Stealth)
  • T1036.005 Match Legitimate Resource Name or Location (Stealth)
  • T1057 Process Discovery (Discovery)
  • T1105 Ingress Tool Transfer (Command And Control)
  • T1203 Exploitation for Client Execution (Execution)
  • and 6 more

Indicators

  • 20 indicators on file

Coverage